KR102037656B1 - Data files protection - Google Patents

Abstract

Protection of the data files is initiated, the protection of the data files comprising: in response to an indication that the data was generated by the client device, determining a security classification associated with the data file; Determining that the security classification associated with the data file includes a confidential file; Storing a data file in a designated virtual storage area; And generating a stub file at the original storage location of the data file, wherein the stub file includes a viewing permission associated with the data file and a storage location of the data file in the designated virtual storage area.

Description

Data files protection

This application is incorporated by reference in the People's Republic of China Application No. 201510295401.9, entitled "Methods, Devices and Terminal Equipment for Protecting Data Files," filed June 2, 2015, incorporated herein by reference for all purposes. Insist on priority.

This application relates to the field of Internet technology. In particular, the present applications are directed to techniques for protecting data files.

In the free and open environment of the Internet, data use, storage, and transmission all provide the risk of leakage. Conventionally, data is protected by transparent file encryption and decryption methods. In particular, one prior art example of data protection includes the following: While the client device operating system performs base level processing, the data file is encrypted. When a user retrieves a data file, the operating system decrypts the data file and then places it in memory for use by the user. When a user needs to store a data file, the operating system encrypts the data file and writes it to a magnetic disk, whereby the user is not fully aware of the encryption and decryption operations performed on the data file. Thus, conventionally, data leaks are prevented by writing encrypted data to a magnetic disk and encrypting the data in memory.

However, these prior arts do not guarantee that files in memory will not leak.

The present invention is an apparatus; system; Composition of the substance; A computer program product implemented on a computer readable storage medium; And / or a processor as a process, such as a processor stored on and / or configured to execute instructions provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of the disclosed processes may vary within the scope of the present invention. Unless stated otherwise, a component such as a processor or memory that is described as being configured to perform a task may be implemented as a particular component that is designed to perform a task or as a general component that is configured in time to perform a task at a given time. have. As used herein, the term 'processor' refers to one or more devices, circuits, and / or processing cores configured to process data, such as computer program instructions.

A detailed description of one or more embodiments of the invention is provided below in conjunction with the accompanying drawings that illustrate the principles of the invention. Although the present invention is described in conjunction with these embodiments, the present invention is not limited to any embodiment. It is intended that the scope of the invention only be limited by the claims, and the invention shall include many alternatives, modifications, and equivalents. Numerous details are set forth in the following detailed description to provide a thorough understanding of the present invention. These details are provided for the purpose of illustration and the invention may be practiced according to the claims without some or all of these specific details. For purposes of clarity, technical material known in the technical fields related to the present invention has not been described in detail so as not to unnecessarily obscure the present invention.

Example embodiments will be described in detail herein. Examples thereof are shown in the drawings. The following descriptions refer to the same or similar elements in the different figures that refer to the same figures unless otherwise indicated. The implementations described in the example embodiments do not represent all implementations consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application described in detail in the claims.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. Single forms used in the present application and appended claims are also intended to include the plural forms unless specifically indicated otherwise in the context. In addition, it is to be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated elements.

This application employs the terms “first”, “second”, “third”, etc. to describe various information, but it should be understood that this information should not be limited by these terms. These terms simply serve to distinguish parts of information of the same category. For example, as long as they are within the scope of the present application, the first part of the information may be called the second part of the information. Similarly, the second portion of the information may be referred to as the first portion of the information. Depending on the context, for example, the term "if" used herein may be interpreted as "when" or "if is confirmed".

Embodiments of protecting data files are described herein. In response to the indication of the creation of the data files at the client device, a security classification associated with the data file is determined. The security classification associated with the data file is determined whether it is a classified file. The data file is then stored in the designated virtual storage area. For example, the designated virtual storage area is part of the cloud server. In various embodiments, a "cloud server" refers to one or more servers working in concert to provide one or more services. The stub file is created in the original storage location of the data file. In addition, a copy of the data file is removed / deleted from the client device. The stub file includes the viewing permissions associated with the data file and the storage location of the data file within the designated virtual storage area, but is not the actual content of the data file. Since the stub file does not contain any data from the data file itself, any operations performed by the user on the stub file of the client device will not have any effect on the data file stored on the cloud server.

1 illustrates one embodiment of a system for protecting data files.
2 is a flow diagram illustrating one embodiment of a process for protecting data files.
3 is a flow diagram illustrating one embodiment of a process for sharing a protected data file.
4 is a flow diagram illustrating one embodiment of a process for using a protected data file.
5 is a flow diagram illustrating an example of a process for accessing a protected data file.
6 illustrates an example client device for protecting data files.
7 illustrates an example client device for protecting data files.
8 illustrates an example client device for protecting data files.
9 illustrates an exemplary data file retrieval device.
10 illustrates an example data file retrieval device.
11 is a functional diagram illustrating a computer system programmed for protecting data files.

Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.

1 is a diagram illustrating one embodiment of a system for protecting data files. In an example, system 100 includes client device 102, network 104, and cloud server 106. In some embodiments, network 104 includes high speed networks and / or telecommunication networks.

Client device 102 generates a data file. Examples of client device 102 include a mobile device, smart phones, laptop computer, desktop computer, tablet device, or any computing device. In some embodiments, client device 102 generates a data file by receiving a data file from another client device. In some embodiments, client device 102 may generate a data file by downloading the data file as an attachment from a message received at client device 102 and downloading the data file from a website. The data file can be generated at the client device 102 in any suitable manner. Client device 102 determines a security classification associated with the received data file. The security classification indicates that the data file is a confidential file. In response to determining that the data file is a confidential file, the client device 102 is configured to store the data file in a designated virtual storage area. In various embodiments, the designated storage area is a disk (or solid state) storage device of cloud server 106. After the client device 102 sends the data file over the network 104 to the cloud server 106, the client device 102 generates a stub file associated with the data file, removes its copy of the data file, The stub file is stored in the original storage location of the data file of the client device 102. As such, when client device 102 uploads a data file to cloud server 106, client device 102 no longer holds a copy of the data file, but only a stub file associated with the data file. If the cloud server 106 successfully stores the data file, the cloud server 106 is configured to send the storage location of the data file in the designated virtual storage area via the network 104 to the client device 102. In various embodiments, the stub file records various information associated with the data file, including the viewing permission associated with the data file and the storage location of the data file in the designated virtual storage area of the cloud server 106. The viewing permissions associated with the data file specify which individual users and / or user roles can access (eg, read, write, read and write) the data file.

To access the data file, a user of client device 102 is configured to select a stub file using a virtualized control and management application running on client device 102. For example, a user of client device 102 can browse stub files of data files stored in cloud server 106 via a control and management application virtualized at client device 102. The user of client device 102 can select a stub file corresponding to the data file to access. In response to the user's selection to share the stub file, the virtualized control and management application may access the data file by comparing the user's identification information with the viewing permission that is written to the selected stub file by the user of the client device 102. And to determine whether to have permission. For example, if the user's identification information is specified to be at least authorized to read the stub file by the selected stub file, the virtualized control and management application is configured to permit the access operation. If it is determined that the user can access the data file, the virtual application is configured to launch / run at the client device 102 and establish a connection with the cloud server 106. A user of client device 102 may use a virtual application running on client device 102 to access a data file stored in cloud server 106 that includes by performing word processing operations on the data file. The virtual application is separated from the operating system of the client device 102, which means that operations performed within the virtual application are separated from the storage of the client device 102 and / or the memory of the client device 102.

In some embodiments, a user of client device 102 can share a data file with another client device (not shown in the figure) using a virtualized control and management application running on client device 102. A user of client device 102 may select a stub file corresponding to a data file to share with a user associated with another client device. In response to the user's choice to share the stub file, the virtualized control and management application accesses the data file by comparing the identification information of the other user with the viewing permission that the other user with whom the data file is to be shared is written to the selected stub file. And determine whether to have permission for the. For example, if the user's identification information is specified to be at least authorized to read the stub file by the selected stub file, the virtualized control and management application is configured to permit the sharing operation. If it is determined that another user can access the data file, the virtualized control and management application is configured to send a command to the client device of the user whose data file is to be shared. The command sent is configured to create a copy of the selected stub file on the client device of the user to which the data file is to be shared so that other users can access the data file of the cloud server 106 using the stub file.

As such, storing the confidential data file in a designated virtual storage area of the cloud server 106 while providing access from the client device 102 can thus separate the operations performed on the data file in the virtual environment. Thus, use of the virtual environment may prevent any malicious accesses to the data file of the client device 102 by the user and / or program without proper access permissions or by manipulating the client device 102. Because the stub file records the viewing permission for the data file and the storage location of the data file in the designated virtual storage area but does not contain any data from the data file itself, the stub file is stored by the user for the stub file stored on the client device 102. Any operations performed will not have any effect on the data file stored on cloud server 106.

2 is a flow diagram illustrating one embodiment of a process for protecting data files. In some embodiments, process 200 is implemented in system 100 of FIG. 1.

At 202, in response to an indication that the data file was created by the client device, a security classification associated with the data file is determined.

For example, a data file can be created at a client device through copying a new file, downloading a new file, or creating a new file.

In various embodiments, the security classification of the data file is set by the user, for example, the user who created the file. In some embodiments, the security classification of the data file includes a secret rating of the data file. For example, the security classification can be set to level 0, level 1, or level 2, each level representing a different level of secrecy with respect to the data file. For example, level 0 indicates that the user does not need to employ security measures for the data file, and level 1 indicates that the user needs to take security measures for the data file. In another example, level 0 indicates that the user does not need to employ security means for the data file, level 1 indicates that the user needs to employ security means for the data file on the client device, and level 2 Indicates that the user needs to employ security measures for data files on the client device and the cloud server.

In some embodiments, the content information of the data file may first be determined to determine a security classification associated with the data file. For example, the content information of the data file can be matched against the first preset state, and the security classification of the data file is determined according to the first matching result. For example, the first preset state may include a number of key phrases, such as "encrypted", "private", or "private." When the system detects that the content information of the data file includes content such as "encrypted" or "private", the security classification of the data file is determined to be level 1 according to the first matching result, which means that the user Indicates that you need to take security measures for the data file. If the content information does not include the aforementioned key phrases, it is possible to determine that the classification level of the data is level 0 according to the first matching result, and level 0 does not require the user to take security measures for the data file. Indicates. In a second example, the file name of the data file may be matched for a second preset state, and the security classification of the data file is determined according to the second matching result. For example, the second preset state may include a number of key phrases such as "secret" or "encrypted." If the system detects that the file name of the data file contains content such as "secret" or "encrypted," the security classification of the data file according to the first matching result may be determined as level 1, and level 1 is determined by the user. Indicates that security measures are required for the data file. If the file name does not include the aforementioned key phrases, it can be determined that the classification level of the data according to the second matching result is level 0, which indicates that the user does not need to take security measures for the data file.

At 204, it is determined that the security classification associated with the data file includes a confidential file.

The security classification associated with the data file is determined based on the technique as described above, and it is determined that the data file is a confidential file based on the security classification.

If it is determined that the data file is a non-confidential file (eg, a file for which no security measures are required), the data file is generally stored and / or generally provided to the user. The storage and / or use of non-confidential files will not be described further.

At 206, the data file is stored in the designated virtual storage area.

The data file determined to be a confidential file is stored in the designated virtual storage area. In some embodiments, the virtual storage area may be a specific magnetic disk array section for storing data files (eg, confidential files) that are on a magnetic disk of a client device and require security measures. When a user needs to access a data file stored in a virtual storage area, a virtual application that is separated from the client device operating system (and may include storage detachment and memory detachment, etc.) is launched on the client device, and the client device Data files stored in the virtual storage area of can be accessed through the virtual application.

In some embodiments, the virtual storage area is on a magnetic disk of a (eg, remote) cloud server and is a specific magnetic disk array for storing data files (eg, confidential files) that require security measures. It may be a section. When a user's client device cannot store a data file or adopt security measures for the data file, the virtual device that is separated from the client device operating system (and may include storage detachment, memory detachment, etc.) Data files that are initiated at and stored in the virtual storage area of the cloud server can be accessed through the virtual application. Thus, it is possible to separate any operations performed on the data file stored in the virtual storage area on the cloud server in the virtual environment and to prevent the data file from leaking.

At 208, a stub file is created in the original storage location of the data file, and the stub file includes a viewing permission associated with the data file and a storage location of the data file within the designated virtual storage area.

The data file is stored in its original storage location (eg, in a storage device associated with the client device) before being stored in the storage location in the designated virtual storage area. In various embodiments, if a data file is stored in a designated virtual storage area, a copy of the data file is deleted from the original storage location and the stub file is stored in the original storage location instead. In various embodiments, the stub file records the viewing permission (s) associated with the data file and the storage location of the data file in the designated virtual storage area. In various embodiments, the viewing permission (s) associated with the data file may include the roles of the designated users and / or users who are allowed to access (eg, read, write, read and write) the data file (eg, For example, administrator users, guest users, guests of a particular group of users).

In various embodiments, when a user selects a stub file at the client device, the stub file stored in the original storage location of the data file is sent to the client device (operating system) to determine whether the selected user has viewing permission. Will be read by. The data file can be retrieved from the storage location of the designated virtual storage area only if it is determined that the selected user has viewing permission to access the data file. Thus, the data file is viewed from the storage location of the designated virtual storage area. As described in more detail below, accessing data files from a designated virtual storage system is intended to drive a virtualized environment that provides access to data files within a designated virtual storage area (eg, from a cloud server). Include. However, if the selected user does not have viewing permission, the selected user is denied access to the data file in the designated virtual storage area.

3 is a flow diagram illustrating one embodiment of a process for sharing a protected data file. In some embodiments, process 300 is implemented in system 100 of FIG. 1.

At 302, a first command is received from a first user to share a data file with a second user.

In some embodiments, the first user can share the data file with another user by using a client device application or stub file-sharing key to initiate sharing the stub file with another designated user. In some embodiments, the data file to be shared is already uploaded to the cloud server, and only the stub file corresponding to the data file is stored on the client device of the user who wants to share the data file with another user.

At 304, user information associated with a second user is determined. In some embodiments, the user information may include the account number of the other user in the client application, or may include an email address from which the other user can receive the data file. In other words, the present application does not impose restrictions relating to the addresses contained in user information with which data files can be shared. What is needed is that other users can receive the data file.

At 306, it is determined whether the second user has permission to access the data file based at least in part on user information associated with the second user. If it is determined that the second user has permission to access the data file, control passes to 308. Alternatively, if it is determined that the second user does not have permission to access the data file, then the second user is denied access to the data file (eg, the data file may be shared with him / her). Message is sent to the second user), the process 300 ends.

The user information associated with the second user is compared with the viewing permission associated with the data file included in the stub file of the data file to determine whether the second user has permission to access the data file. For example, user information associated with the second user may include identification information associated with the second user and roles associated with the second user.

At 308, the data file is uploaded to and stored in the designated virtual storage area of the cloud server.

In some embodiments, if a copy of the data file has not been uploaded and stored in a designated virtual storage area of the cloud server (eg, for backup storage), the copy of the data file is stored in the designated virtual storage area of the cloud server. Uploaded. For example, a first user who wants to share a data file with a second user can use a client device application or stub file upload key to upload the data file to the cloud server. In some embodiments, the client application can be virtualized control and management software installed on the client device.

At 310, the second command is sent to the client device associated with the second user, and the second command is configured to generate a stub file corresponding to the data file on the client device associated with the second user.

In some embodiments, identification information associated with the second user is determined from user information associated with the second user. After the second user receives the second command via the corresponding client device, a stub file for the data file on the client device of the second user is generated based on the second command. For example, the generated copy of the stub file is stored in its original location where the data file is stored on the client device of the second user. The client device of the second user may then use the stub file as the basis for obtaining the data file from the designated virtual storage area of the cloud server. In various embodiments, described above, the stub file records the viewing permission (s) associated with the data file and the storage location of the data file in the designated virtual storage area.

As described in process 300, when a data file needs to be shared, a second command is sent to the second user in accordance with the user information. After the second user confirms receipt of the data file via their client device, the data file stub file is created on the client device of the second user. Thus, sharing of data files that need to be kept secret is shared virtually by sharing stub files. Since the basic data of the data file is not transferred to the second user and the shared stub file only stores the storage location and viewing permission of the data file in the virtual storage area and does not contain any data information of the data file itself, Any actions performed by the second user on his or her copy will not have any effect on the data file. This ensures that secret information will not be leaked from the data file in the sharing process.

4 is a flow diagram illustrating one embodiment of a process for using a protected data file. In some embodiments, process 400 is implemented in the system of FIG. 1.

At 402, a user selection associated with the stub file is received at the client device.

The user selection associated with the stub file is received at the client device. In various embodiments, the stub file corresponds to a data file stored in a designated virtual storage area of the cloud server and generated based on a process such as process 200 of FIG. 2 or process 300 of FIG. 3. For example, the stub file is displayed in a file browser application running on the client device. In some embodiments, the stub file is displayed in the file browser application in the same manner as the associated data file stored locally on the client device instead of the designated virtual storage area of the cloud server.

In some embodiments, a client application installed on a client device can be used to monitor for stub file-related click events. In some embodiments, the user has already logged on to the client application using the user's credentials. In some embodiments, the click event may be a double-click event for a stub file or may be a click event for a stub file when displayed on a displayed menu or file browser application. In some embodiments, the client application can record stub files and thus determine whether the clicked file is a stub file or an original data file.

At 404, it is determined whether the user associated with the user selection has permission to access the data file associated with the stub file based at least in part on the viewing permission associated with the data file included in the stub file. If the user associated with the user selection has permission to access the data file, control passes to 406. Alternatively, if the user associated with the user selection does not have permission to access the data file, the user is denied access to the data file and the process 400 ends.

As described above, the stub file records the viewing permission of the corresponding data file and the storage location of the data file in the designated virtual storage area of the cloud server. The user information associated with the user who selected the stub file is compared with the viewing permissions included in the stub file to determine whether the user associated with the selection is a user with the viewing permission of the data file.

At 406, the virtual application corresponding to the data file is launched at the client device.

At 408, access to the data file of the designated virtual storage area is provided using the virtual application.

In various embodiments, the virtual application is a virtualized control and management software application installed on a client device. In various embodiments, the virtual application is separate from the operating system of the client device. In various embodiments, the separation of the virtual application from the operating system can include separating storage from the operating system, which can also include separating memory from the operating system. Thus, the virtual application is separated within the virtual environment in which any action performed by the user on the data file is provided by the virtual application, thereby allowing malicious users who are not authorized access to the virtual application from within the virtual application. Prevents obtaining any data resources. In some embodiments, a user's access to a data file via a virtual application may include, for example, general reading, editing, and use of clipboards. In some embodiments, the operations performed by the user on the data file will be executed on the cloud server where the data file is stored rather than on the client device where the stub file is stored. In various embodiments, the virtual application is configured to locate the data file stored in the designated virtual storage area of the cloud server using the storage location of the data file included in the stub file. 5 illustrates an example of using a virtual application to access a data file stored in a designated virtual storage area of a cloud server below.

5 is a flow diagram illustrating an example of a process for accessing a protected data file. In some embodiments, process 500 is implemented in system 100 of FIG. 1.

In various embodiments, stub files corresponding to (eg, confidential) data files are stored on the client device, while the data files are stored in a designated virtual storage area on the cloud server. Process 500 obtains a data file from a designated virtual storage area on a cloud server using a virtual application after the stub file is selected at the client device (eg, as described in process 400 of FIG. 4 above). This is an example of a process for doing so.

At 502, the client device initiates a Remote Desktop Protocol (RDP) component connected to a cloud server where the data file is stored based at least in part on information included in the stub file associated with the data file.

After detecting that the user has selected the stub file of the client device (e.g., using a process such as process 400 of FIG. 4 above), the client device may determine the Remote Desktop Protocol according to the information recorded in the stub file. Start the (RDP) component. The RDP component is an example virtual application that can be used to access data files on the cloud server to which the data files are accessed. The RDP component is used to connect to the cloud server where data files are stored.

At 504, the client device sends the information contained in the stub file to the cloud server via the RDP component.

In some embodiments, all data information recorded in the stub file is encrypted by the client application. The encrypted data application records information associated with the data file corresponding to the stub file, the associated information being for example: a storage location of the data file in the designated virtual storage area of the cloud server, user permissions for the data file, One or more of a data file-sharing procedure, and historical records of the use of the data file. In some embodiments, the information contained in the stub file sent from the client device to the cloud server may include, for example: storage location of the designated virtual storage area of the cloud server where the data file is stored, client application user permissions, One or more of the information needed, and a virtual storage path on the server to the server for the data file to be opened.

At 506, after the cloud server verifies the information sent, the cloud server starts a remote virtualization program on the client device and opens the data file on the cloud server according to the designated virtual storage area storage location included in the stub file.

At 508, the cloud server maps a document editor program on the client device.

In some embodiments, the cloud server can establish a new editable file using a text editor program (eg, Microsoft Word) and then send a full visible window for the editable file on the client device. . Thus, the remote text editor can be mapped on the client device. In some embodiments, mapping the text editor on the client device includes sending a user interface of the text editor to be displayed on the client device.

At 510, the client device uses a text editor program to perform operations on data files stored on the cloud server.

In some embodiments, the operations received at the client device from a user to perform on the data file using a text editor program mapped by the cloud server on the client device may include, for example, viewing or editing the data file contents; Copying the data file. User actions performed via the document editor program user interface at the client device are sent to the cloud server and then executed on the data file of the cloud server. This application does not impose restrictions on specific operations with respect to a data file.

In a first example, after a first user has shared with a second user (eg, a confidential data file) (eg, using a process such as process 300 of FIG. 3), the second user has no data. It receives only stub files at the user's client device rather than a copy of the file itself. When the second user needs to use the stub file based on obtaining the data file from the cloud server, the second user can select a stub file stored on the client device of the second user and process 400 of FIG. 4. Processes such as process 500 of FIG. 5 may be used to provide user access to data files stored in designated virtual storage areas of a cloud server.

In a second example, if the data file is stored in the designated virtual storage area of the cloud server because the client device magnetic disk has limited storage space or is not set by the virtual storage area, the process 400 of FIG. 4 and FIG. 5. Processes, such as process 500, provide a user of a client device with access to a data file from a virtual area of the cloud server when the user needs to obtain a data file from the cloud server based on the stub file. Can be used for

In a third example, when a user needs to perform operations on a data file from a cloud server via a different client device, process 400 of FIG. 4 and process 500 of FIG. 5 provide access to the data file. Can be used to provide remotely. For example, a user of client device A creates a stub file for the data file and stores the data file in a virtual area of client device A. When a user transfers a stub file from client device A to client device B, and after client device A uploads the data file to the cloud server, the user needs to retrieve the data file from client device B, Process 400 of FIG. 4 and process 500 of FIG. 5 can be used to perform operations on data files from a cloud server.

Applications such as Citrix XenApp and other such applications can be quite expensive. Thus, as described above, the present application can use the Windows operating system, for example, by employing an RDP-based application virtualization scheme. By using RDP control components, message hooks, and window clipping techniques, remote application virtualization techniques can be achieved, thus avoiding the dependency of the client device's own operating system and allowing the cloud server to run any window. Adopt a system, which is more flexible for the user of the data file.

The following example is based on the embodiments described above: When a data file experiences operations by a user, a client application installed on the client device may also be used to monitor the operations performed by the user on the data file. Can be used. In some embodiments, the operations performed by the user on the data file may be performed on the client device or they may be performed on the data file by the user via a text editor mapped on the client device from the cloud server. And thus allows for the effective monitoring and management of data file opening, manipulation, flow, and all other data file related operations performed by the user.

6 is a diagram illustrating an example client device for protecting data files. As shown in the example, the client device includes a processor, an internal bus, network ports, internal memory, and nonvolatile memory. In particular, the client device may also include other hardware when needed to perform business services. The processor may obtain a corresponding computer program from nonvolatile memory to internal memory and then execute it. The data file protection device is formed in the logic layer. The present application does not exclude other implementations besides software implementations, for example a logic device or combined software / hardware form. In other words, the entity executing the processes described above need not be limited to various logic units, but may be hardware, software, or a combination of both.

7 is a diagram illustrating an example client device for protecting data files. In an example, device 700 includes a first determination module 71, a storage module 72, and a stub generation module 73.

Modules and units may be implemented as hardware, such as programmable logic devices, as software components executing on one or more processors, and / or custom integrated circuits on which the elements are designed may be computer devices (eg, personal computers, Servers, network equipment, etc.) stored on a nonvolatile storage medium (e.g., optical disk, flash storage device, mobile hard disk, etc.) that includes a plurality of instructions for implementing the methods described in embodiments of the present invention. It may be implemented by one form of software products that can be. Modules and units may be implemented on a single device or distributed across multiple devices.

The first determining module 71 is configured to determine an original storage location of the data file and a security classification of the data file in response to the creation of the data file on the client device.

The storage module 72 is configured to store the data file in the designated virtual storage area if the security classification determined by the first determining module indicates that the data file is a confidential file.

The stub generation module 73 is configured to generate a stub file in the original storage location determined by the first determination module 71. The stub file is configured to record the storage location of the data file of the designated virtual storage area and the viewing permission for the data file.

8 is a diagram illustrating an example client device for protecting data files. In some embodiments, device 800 is an example implementation of device 700 of FIG. 7. In the example of device 800, the first determining module 71 of the device 700 includes a first determining unit 711, a first matching unit 712, a second determining unit 173, and a second matching unit. 714. The device 800 includes a monitoring module 78, a storage module 72, a second determination module 74, a transmission module 75, a third determination module 76, an uploading module 77, and a stub generation module ( 73).

The first determining unit 711 is configured to determine content information of the data file.

In some embodiments, the first matching unit 712 is configured to match the content information determined by the first determining unit 711 with respect to the first preset state and determine a security classification of the data file according to the first matching result. It is composed.

In some embodiments, the second determining unit 173 is configured to determine the file name of the data file.

The second matching unit 714 is configured to match the file name determined by the second determining unit 713 with respect to the second preset state and determine the security classification of the data file according to the second matching result.

The second determining module 74 detects the first command indicating that the first user has selected to share the data file stored by the storage module 72 with the client device of the second user designated by the first user. 2 is configured to determine user information for the user.

The sending module 75 is configured to use the user information determined by the second determining module 74 based on sending the second command to the second user to instruct the second user to receive the data file. After the second user receives the data file via the corresponding client device, the transfer module 75 is configured to generate a stub file for the data file on the client device of the second user.

The third decision module 76 is configured to use the user information determined by the second decision module 74 based on determining whether the second user has viewing permission for the data file.

The uploading module 77 is configured to receive an indication from the third decision module 76 associated with the determination that the second user has viewing permission for the data file. In response to the indication, the uploading module 77 is configured to upload and save the data file to the cloud server such that the second user can use the stub file based on obtaining the data file from the cloud server. .

The monitoring module 78 is configured to use a client application installed on the client device to monitor user actions performed by the user on the data file.

9 is a diagram illustrating an example data file retrieval device. In an example, device 900 includes a fourth determining module 91, a starting module 92, and an accessing module 93.

The fourth determination module 91 is configured to determine whether the user associated with selecting the stub file has permission to access the data file according to the viewing permission recorded by the stub file.

When the fourth decision module 91 determines that the user has permission to access the data file, the launch module 92 is configured to launch a virtual application corresponding to the data file.

The accessing module 93 is configured to use the virtual application started by the startup module 92 to access the data file stored in the designated virtual storage area storage location recorded by the stub file.

10 is a diagram illustrating an exemplary data file retrieval device. In some embodiments, device 900 of FIG. 9 may be implemented using an example of device 1000. In the example of device 1000, the accessing module 93 includes a network connection unit 931, a transmission unit 932, and an operating unit 933.

The network connection unit 931 is configured to connect to the cloud server through the remote desktop protocol component based on the information recorded by the stub file associated with the data file to be accessed.

The sending unit 932 is a document editor for the cloud server to launch a remote virtual program on the client device and edit the data file stored on the cloud server after the cloud server successfully verifies the information recorded by the storage file. Use the specified virtual storage location recorded by the stub file based on mapping the program to the client device.

The operation unit 933 is configured to perform operations on the data file stored on the cloud server via a text editor.

11 is a functional diagram illustrating one exemplary embodiment of a computer system programmed to protect data files. As should be clear, other computer system architectures and configurations can be used to protect data files. Computer system 1100 including various subsystems described below includes at least one microprocessor subsystem (also referred to as a processor or central processing unit (CPU)) 1102. For example, processor 1102 may be implemented by a single chip processor or by multiple processors. In some embodiments, processor 1102 is a general-purpose digital processor that controls the operation of computer system 1100. Using instructions retrieved from memory 1100, processor 1102 controls the reception and manipulation of input data and the output and display of data on output devices (eg, display 1118).

The processor 1102 is bidirectionally coupled with a memory 1110, which may include a first main memory area, typically random access memory (RAM), and a second main memory area, generally read-only memory (ROM). As is well known in the art, the main memory device can be used as a general storage area and as a scratch-pad memory, and can also be used for storing input data and processed data. The main memory device may also store programming instructions and data in the form of data objects and text objects in addition to instructions and other data for processes running on the processor 1102. As is also well known in the art, a main memory device generally includes basic operating instructions, program code, data, and objects (eg, programmed instructions) used by the processor 1102 to perform its functions. ). For example, the memory 1110 may include any suitable computer readable storage medium described below, for example, depending on whether the data access needs to be bidirectional or unidirectional. For example, processor 1102 can also retrieve and store data frequently and very quickly needed in cache memory (not shown).

Removable mass storage device 1112 provides additional data storage capacity for computer system 1100 and is coupled to processor 1102 in both directions (read / write) or unidirectional (read only). For example, storage 1112 may also include computer readable media such as magnetic tape, flash memory, PC-CARDs, removable mass storage devices, holographic storage devices, and other storage devices. . The fixed mass storage device 1120 may also provide additional data storage capacity, for example. The most common example of a fixed mass storage device 1120 is a hard disk drive. Mass storage devices 1112 and 1120 typically store additional programming instructions, data, and the like that are not actively used by processor 1102. It will be appreciated that the information retained in storage devices 1112, 1120 can be integrated in a standard manner as part of memory 1110 (eg, RAM) as virtual memory, if necessary.

In addition to providing processor 1102 with access to storage subsystems, bus 1114 may also be used to provide access to other subsystems and devices. As shown, these are displays 1118, network interface 1116, keyboard 1104, and pointing device 1108, as well as auxiliary input / output device interfaces, sound cards, speakers, and other subs as needed. Systems may be included. For example, the pointing device 1108 may be a mouse, stylus, trackball, or tablet and is useful for interfacing with a graphical user interface.

The network interface 1116 allows the processor 1102 to be coupled to another computer, computer network, or telecommunications network using the network connection shown. For example, via network interface 1116, processor 1102 may receive information from another network (e.g., data objects or program instructions) in the course of performing method / process steps or in another network. You can output the output information. Information, often represented as a series of instructions to be executed on a processor, can be received from and output to another network. Appropriate software implemented by an interface card or similar device and processor 1102 (eg, executed / executed) may be used to connect computer system 1100 to an external network and move data in accordance with standard protocols. Can be. For example, the various process embodiments disclosed herein may be executed on processor 1102 or may be performed over a network such as the Internet, intranet networks, or local area networks, with a remote processor sharing some of the processing. Can be. Additional mass storage devices (not shown) may also be connected to the processor 1102 through the network interface 1116.

A secondary I / O device interface (not shown) may be used with the computer system 1100. The secondary I / O device interface allows the processor 1102 to allow microphones, touch-sensitive displays, transducer card readers, tape readers, voice or handwriting readers, biometric readers, cameras, removable mass storage devices. And general and customized interfaces for sending and more generally receiving data from other devices, such as, and other computers.

As described in the various embodiments above, when it is determined that the data file is a confidential file, the data file is stored in the designated virtual storage area. Thus, user actions on the data file stored in the designated virtual storage area can be prevented from being manipulated by malicious users and / or programs in the client device to which the data file is separated and accessed in the virtual environment. The stub file is created in the original storage location of the data file on the client device. Since the stub file only records the viewing permission of the data file and the storage location of the data file in the virtual storage area and does not include any file from the data file itself, any operations performed by the user on the stub file are It will not have any effect on the file.

Given the invention disclosed herein, those skilled in the art and the description will readily conceive other ways to implement the present application. This application is intended to cover any adaptations, uses, or adaptations of the present application, which variations, uses, or adaptations are disclosed in the present technology which conforms to the general principles of the present application and is not disclosed by the present application. General knowledge or conventional technical means. The description and examples are to be considered merely illustrative. The true scope and spirit of this application is indicated by the following claims.

Also note that the terms "comprises" or "comprising" or any of their variations are taken in their non-excluded meaning. Thus, an equipment comprising processes, methods, article, or series of elements includes not only these elements but also other elements not explicitly listed or elements unique to such processes, methods, articles, or equipment. Also includes. In the absence of other limitations, the elements defined by the phrase "comprise ..." do not exclude the presence of additional identical elements in processes, methods, articles, or equipment that includes the elements.

Preferred embodiments of the present application are merely described above and do not serve to limit the present application. Any modifications, equivalent substitutions, or improvements made will fall within the protection scope of the present application.

The following examples have been described in some detail for clarity of understanding, but the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.

Claims (20)

In the way:
Using one or more processors, in response to an indication that the data file was generated by the first client device, determining a security classification associated with the data file;
Using the one or more processors to determine if the security classification associated with the data file includes a classified file;
Using the one or more processors, storing the data file in a designated virtual storage area;
Generating a first stub file at an original storage location of the data file, the first stub file including a viewing permission associated with the data file and a storage location of the data file within the designated virtual storage area; Generating the first stub file;
Receiving a first command from a first user to share the data file with a second user;
Determining user information associated with the second user;
Determining whether the second user has permission to access the data file based at least in part on the user information associated with the second user; And
Transmitting a second command to a second client device associated with the second user, wherein the second command generates a second stub file corresponding to the data file at the second client device associated with the second user. And the second stub file is used to obtain the data file in the designated virtual storage area. The method of claim 1,
And the designated virtual storage area is associated with a cloud server. The method of claim 1,
Determining the security classification associated with the data file includes:
Comparing content information associated with the data file against a preset condition; And
Determining the security classification based at least in part on a result of the comparison. The method of claim 1,
The security classification associated with the data file is set by a third user. The method of claim 1,
Storing the first stub file in the original storage location associated with the data file. The method of claim 1,
Receiving a user selection associated with the first stub file to access the data file;
Determining whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, executing a virtual application corresponding to the data file; And
Using the virtual application to provide access to the data file to the designated virtual storage area. The method of claim 1,
Receiving a user selection associated with the first stub file to access the data file;
Determining whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, executing a virtual application corresponding to the data file; And
Sending information included in the first stub file to a cloud server associated with the designated virtual storage area and receiving a user interface associated with a text editor program from the cloud server, thereby using the virtual application to access the specified virtual storage area. Providing access to the data file. The method of claim 1,
Receiving a user selection associated with the first stub file to access the data file;
Determining whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, executing a virtual application corresponding to the data file; And
Send information included in the first stub file to a cloud server associated with the designated virtual storage area, receive a user interface associated with a text editor program from the cloud server, and perform the data file via the user interface. Receiving an operation and providing access to the data file of the designated virtual storage area using the virtual application that includes by sending the operation to the cloud server. delete A non-transitory computer readable storage medium having stored thereon a computer program comprising computer instructions, the method comprising:
The computer instructions are:
In response to an indication that the data file was created by the first client device, determine a security classification associated with the data file;
Determine whether the security classification associated with the data file includes a confidential file;
Store the data file in a designated virtual storage area;
Creating a first stub file at an original storage location of the data file, the first stub file including a storage location of the data file and a viewing permission associated with the data file in the designated virtual storage area; Create a stub file;
Receive a first command from a first user to share the data file with a second user;
Determine user information associated with the second user;
Determine whether the second user has permission to access the data file based at least in part on the user information associated with the second user;
Sending a second command to a second client device associated with the second user, wherein the second command is configured to generate a second stub file corresponding to the data file at the second client device associated with the second user. And the second stub file is for transmitting the second command, used to obtain the data file in the designated virtual storage area. The method of claim 10,
And the designated virtual storage area is associated with a cloud server. The method of claim 10,
Determining the security classification associated with the data file is:
Comparing the content information associated with the data file against a preset state; And
And determining the security classification based at least in part on a result of the comparison. The method of claim 10,
And the security classification associated with the data file is set by a third user. The method of claim 10,
Non-transitory computer readable storage medium further for storing the first stub file in the original storage location associated with the data file. The method of claim 10,
Receive a user selection associated with the first stub file to access the data file;
Determine whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, execute a virtual application corresponding to the data file; And
And providing access to a data file of the designated virtual storage area using the virtual application. The method of claim 10,
Receive a user selection associated with the first stub file to access the data file;
Determine whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, execute a virtual application corresponding to the data file; And
Sending the information included in the first stub file to a cloud server associated with the designated virtual storage area and receiving a user interface associated with a text editor program from the cloud server using the virtual application. Non-transitory computer readable storage medium further for providing access to the data file of the region. The method of claim 10,
Receive a user selection associated with the first stub file to access the data file;
Determine whether a third user associated with the user selection has permission to access the data file;
If the third user has permission to access the data file, execute a virtual application corresponding to the data file; And
Send information included in the first stub file to a cloud server associated with the designated virtual storage area, receive a user interface associated with a text editor program from the cloud server, and perform the data file via the user interface. And further providing access to the data file of the designated virtual storage area using the virtual application comprising receiving an action and sending the action to the cloud server. Storage media. delete In the system,
One or more processors,
The one or more processors are:
In response to an indication that the data file was created by the first client device, determine a security classification associated with the data file;
Determine whether the security classification associated with the data file includes a confidential file;
Store the data file in a designated virtual storage area;
Creating a first stub file at an original storage location of the data file, the first stub file including a storage location of the data file and a viewing permission associated with the data file in the designated virtual storage area; Create a stub file;
Receive a first command from a first user to share the data file with a second user;
Determine user information associated with the second user;
Determine whether the second user has permission to access the data file based at least in part on the user information associated with the second user;
Sending a second command to a second client device associated with the second user, wherein the second command is configured to generate a second stub file corresponding to the data file at the second client device associated with the second user. And the second stub file is configured to send the second command used to obtain the data file in the designated virtual storage area. The method of claim 19,
And the designated virtual storage area is associated with a cloud server.

Images